-
Notifications
You must be signed in to change notification settings - Fork 24
Expand file tree
/
Copy pathp3_detection_rules.txt
More file actions
45 lines (41 loc) · 3.14 KB
/
Copy pathp3_detection_rules.txt
File metadata and controls
45 lines (41 loc) · 3.14 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
port_scan;300;prot=6;sip,dip;dport;unique;flows=30-;sip,dip
kugoo;300;prot=6,dport=3318|7000;sip,dip;dport;count;null;sip,dip,flows
bitsprit;300;prot=6,dport=16881;sip,dip;dport;count;null;sip,dip,flows
baocue;300;prot=6,dport=6346;sip,dip;dport;count;null;sip,dip,flows
ptc;300;prot=6,dport=50007;sip,dip;dport;count;null;sip,dip,flows
poco;300;prot=6,dport=2881|5354|8094;sip,dip;dport;count;null;sip,dip,flows
black_hole_2001;300;prot=6,dport=2001;sip,dip;dport;count;null;sip,dip,flows
ripper;300;prot=6,dport=2023;sip,dip;dport;count;null;sip,dip,flows
wincrash_v2;300;prot=6,dport=2583;sip,dip;dport;count;null;sip,dip,flows
ping_of_death;300;prot=1;sip;dip;count;pkts=10-;sip,dip
backdoor;300;prot=6,dport=1999;sip,dip;dport;count;null;sip,dip,flows
vnc;300;prot=6,dport=5800|5900;sip,dip;dport;count;null;sip,dip,flows
daeare_nt_utilities;300;prot=6,dport=6129;sip,dip;dport;count;null;sip,dip,flows
guangwai_dirl;300;prot=6,dport=6267;sip,dip;dport;count;null;sip,dip,flows
remote_administrator;300;prot=6,dport=4899;sip,dip;dport;count;null;sip,dip,flows
worm.killmsblast,w32.nachi.worm,w32.welchia.worm;300;dport=2048,prot=1,bytes=92;sip,dip;dport;count;null;sip,dip,flows
w32.witty.worm;300;sport=4000,prot=17;sip,dip;dport;count;null;sip,dip,flows
shockwave_killer;300;dport=2048,prot=1,bytes=92;sip,dip;dport;count;null;sip,dip,flows
wincrash_v2;300;prot=6,dport=2583;sip,dip;dport;count;null;sip,dip,flows
deepthroat_v.0-3.1;300;prot=6,dport=6670|6671;sip,dip;dport;count;null;sip,dip,flows
indoctrination;300;prot=6,dport=6939;sip,dip;dport;count;null;sip,dip,flows
priority;300;prot=6,dport=6969;sip,dip;dport;count;null;sip,dip,flows
netspy;300;prot=6,dport=7306;sip,dip;dport;count;null;sip,dip,flows
netfairy;300;prot=6,dport=7777|7778|11300;sip,dip;dport;count;null;sip,dip,flows
emule;300;prot=6,dport=4242|4661|4662;sip,dip;dport;count;null;sip,dip,flows
worm.sasser;300;dport=445,prot=6,bytes=48;sip,dip;dport;count;flows=100-;sip,dip,flows
code_red_worm;300;dport=80,prot=6,pkts=3,bytes=144;sip,dip;dport;count;null;sip,dip,flows
back_orifice2000;300;prot=6,dport=54320;sip,dip;dport;count;null;sip,dip,flows
netbus;300;prot=6,dport=12345;sip,dip;dport;count;null;sip,dip,flows
subseven;300;prot=6,dport=27374|1243;sip,dip;dport;count;null;sip,dip,flows
qqlive;300;prot=17,dport=12999-14001;sip,dip;dport;count;null;sip,dip,flows
synflood;300;prot=6,syn=1,ack=0,fin=0;sip,dip;sport,dport;count;flows=20-;sip,sport,dip,dport
xunlei;300;prot=6,dport=3076|3077;sip,dip;dport;count;null;sip,dip,flows
worm.opasoft,w32.opaserv.worm;300;dport=137,prot=17,bytes=78;sip,dip;dport;count;null;sip,dip,flows
worm.netkiller2003,worm.sqlp1434,w32.slammer,w32sqlexp.worm;300;dport=1434,prot=17,bytes=404;sip,dip;dport;count;null;sip,dip,flows
worm.blaster,w32.blaster.worm;300;dport=135,prot=6,bytes=48;sip,dip;dport;count;null;sip,dip,flows
genue;300;prot=6,dport=7511;sip,dip;dport;count;null;sip,dip,flows
clacier;300;prot=6,dport=7626;sip,dip;dport;count;null;sip,dip,flows
way2.4;300;prot=6,dport=8011;sip,dip;dport;count;null;sip,dip,flows
back_arifice;300;prot=6,dport=31337;sip,dip;dport;count;null;sip,dip,flows
#kamun;300;prot=6,dport=3651|3753|4772|4774;sip,dip;dport;count;null;sip,dip,flows